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(54) FEATURES AND LIST OF ORIGINATION AND DESTINATION FOR SPAM 
PREVENTION 

(57)Abstract: 

PROBLEM TO BE SOLVED: To provide a system and 
method that facilitates extracting data from messages for 
spam filtering. . , 

SOLUTION: The extracted data can be treated in the 
form of features, and the features can be used with 
machine learning system so that improved filters can be 
built. Origination information and such data as to be 
related to other information embedded in message body 
which enables a receipient of messages to get in touch 
and/or response to the sender of the messages can be 
extracted as features. The features or a subset can be 
deobfuscated and/or normalized, before they are used 
as features of the machine learning system. The features 
can be used to populate several feature lists which 
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facilitates prevention and detection of spams. Examplary features includes an e-mail address, 
an IP addresses, a URL, embedded images indicating a URL and/or parts of them. 
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3yt^f y^fci yifi*§lSS£tt tfdiRad i cat i Group, Inc. 
(2, 2 00 2^8J?S£. $B2 0&^y>y?S^wM7*-y>m*rC:fcD 

. z<nmt2*mte3fe\z%zt^mziihk%mi>^x^'h. mx&xvwn (tztt 

yb'i-f 4y^HB4#^* : fr*«fc&4'C** o . 
[0004] 

<I . HfESf**)? * /I-? 'J y?micr> 1 -9(2. ^S^l-^^SoX fc*>T* 0 

y\'A.X -y-fe-y') 3&»4>1«5 (feature) tfttSBSfl, £^20<38»|SI£«*Wfc 
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-v*-i;iumimt&±x : ®%ziko&ztitffo$> . 
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x>tMiMtttt, ■y-t- : Jfi<DtetA,t'i-<~ccr)ffimz®mt&z tape* ft . 
zmm-ti zttf®Mfc%&fi\ ttziz'j?%< ti>tifffltffrfr& J: a £i-ft -r t ft 

. L*»U tffttfttlWOltttettiLTfc. fic^t LTWffl&tiffgti&ft. IS lie, * 

"Ttttt#$>ft (tilt http://www.spamcorp.com/buyenlarger.htiii) . ;«URU ! 
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^^Aam^satssftsftfcnriBtt^iSv^ffiti. aa*yy?, s^Ji^^*^ 

ffiaAm^-yUTHU^tiSt^TJliS. Tko£*nft£{4.I,r£?y <y 

? LT <«S v»j , r i -I U -y ? J fctt, #?»-l$Hcfto t»^y 
^rA*^aifc itfffiffl-f ft y?##£fvt^ft 

. -ecifcjifrr^THkx (fctiif. nswca r?&ft7c7Kkx (fro 

m address) jTW> rgfll* ( r e p 1 y-t o ) j rKUA<0*5«^ 
#$>!>) , *fcliff!tt>«S*mai 1 to : 'jy? ( U y?±T*7 U «y?-f ft-I fcCfc 

;b*iTL23. iil^U^^*Wffl{tt>*fc, *#atLTteffl1-ft.Ii:#T'#ft. 
[0009] 

^-;l/^%d7CT r-'UX, ^-iVim^TYVX. ta^ma i 1 t o : 7 YVX^ * r 3fl 

< t t-^it&m^s^T^mmk ixmrnttztrfx-z . ^um^n 

fcttB«l^) i flrV^-;kf»t. ifc«9 0%£jS;Lftl^M^&v^-^&i'£i*{i-tft I P 
[0010] 

*fMJB4, ^•y-fe-i/^^-a^SrP^ftit^.kO. «S!f*ifcxytA^ v-fc- 

14. *fecO>7Hr-^>^^>'^^«y-fe->''5rE8 l J-rft^ts (e^-;P) 
ft*:'* 7*-x&MliLT^fI^fc4l//s^^%3fer-^^»ai7fti^T'J>ft. £tf> 
«. IP7Kl/*flf$8, «^-;U7KU^flHI, fc4y'/t^{4i-7^— AUV 

-xn^r-^ (url) mk^m^Lxmxmmitz^cr), hxvMftztiKT-?* 
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<7)ffi #ct)(5 tAsb'ZAti&tcb'CDZbZt&ZblZ&iX. * 7 -t-Wftmrtllb ^ b' 

l><ri:#T#&v\ *<oko LTti. 'Jy? (fcfcAtf, url) *$j:tf/4fc 

Jtf/ifcfcfcvtA? -oi-fZh u--y?-th ZbtfX'% h . 
[0012] 

*fc(i«»^as$njEafts<ifci*a (fctitf. urd frvrvvtMrnyz? 
$m?iz t zmmz-th z t i . 

[0013] 

o 

[0014] 

[^BJ€-HiS1-S^ftc7)^^®3 
[0015] 

mz. xmiz^xm&iiMiKWbfflith. wmx-u. ^mMtxmmm 

£im?lt:#)£ni%fttl t ®MZtil>. J2lT**Mmt i&< 4 TRW) SWT, 

& - 1 tfx't* izt itumx-m z t immztti. «fc t 

[0016] 

riV7h'>i7Wi^t. V7h?x7. 4fc«ISfT'fW7 b^7«V»Wf* 

t,ZimW^\ ru-^'v^rlX-m^thru^X^ 7ot7t. t7yi?F, mfi^ 
ttW. HfT^Xl/yK, 7n/5A, fcJ;i//4£«::jyt^-?^l>;<fc#T£l>. 
vmnt:#>. ir-'*±X'®i¥1-$>T7V ■y-i'3yl>y--;<h&izffifmm£1-z>zttf 

s . m-txtexv/ZMimfrcDx)/ y mtz 1 o4fcttaaK««B£i8f5* I »e ; t 
yt'^-mx^m-i z t h . 
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[0017] 

a. r #taj k^imffi*. wnx. mmxv/£tiitT-fiitixm&&tLt:wi 

titer- f xvm^^mifimm-ztzMzmmztimmfit'ti 
i tx-f- ^*>'ioi tzimmnm £M*t- tm* h<F>\><ryxhh ^mnz^h 
mittfimztii. 

[0018] 

%mm, «'?>-;kt*Lafwciajesfi'f, &m<7)im%Mm7-*T7j- j r£itix 
m&t&zttfX'Zht'tmBnn?* vt-isyrz^tiXoizmmztrrzktfX' 

Z&Zk*mMZtLtz\.\ tzkilf. 2%U±X'<D&m£%%lzt&£mT7°V<?-i'3 
y (tit Hi. ttmmi-^'v hrurjj&xw yxfyh* 7-fe-j;y/rn^7A 
) fcifc. *BJI0#^*$nTV^7'f;^';y^fiM$rvSffl-r§^t* { -C'#l>, k 

- : Jyf* -y -fe-y\ t < I4±ffi?)-f LT»ASii*TOBtt#*4J& 1 4>"C*S . 
h£ Ximm ) * * )Vf 0 y?-Th Xoiizy 4)V?%v v~-yy^h z. 

ktfX%h<?)Xhh, 
[0019] 

■r. r ^-f-'j fcv^fflBtt, mamtx, %mm£tiimm%zm-*itmtf$>z>. 

[0020] 

Ay?*-*v y?u\-n]\> (ip) -mzi y?-*v h±.<7>mwzm-t 

iil<3^>Sc€(i. — r X xx. xxx. xxx. xxx j cr>ftMX'$kZtl. 3-xxx 
14, 0 fc 2 5 5cr>fflX$>&. I P7 KUattJttTfc <Zk ^SUIT'S) 6. 

ti. ^ y?-*-v h±<7>ms^^-y (a^h<\i. m-<?)g8) ^trcfco 

. — r x. c omj & fzli r y . e du j tfzii Courts, wa. govj k 
^oBB<Vl><7)X'h&. 
[0021] 

Y* 4 y%> ( F Q D N ) {4, >f > >y h±^f^^B. £ *(f r b . 
x. c omj ttzlit r c . y . e d u j &tzl£ Twww. courts, wa. govj 
T*9, F^-fy^^{4. r x . comjiftliry. eduj^l^co 

urts.wa. govjTft*. rbj r CJ r WWWJ ffiftliZixZ'ix. FQDNfO 
*^h*9»^W^5. -jft£« iPTFUXtt. K^y^teffl-f 3>£fc**T'#& 

if^ai-cfcffiffl-tiifcj^T&s (fckitf, dn/ipii f*>t>mimi>$>hz 
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X'him?hC\ttfX'Z& (fctllf. FQDN/IP(4. J£1yt,0*I&&i>t>&Z.b$: 
n<t) .. %l-X-)V7YVX\t, titttf r a@x . c omj ££(4 r a @ 1 . 2. 3. 
4 j jl— f£i M'f y£4£(4I PTKlxT. (DN/IP) \£%t><r> 

[0022] 

a-7^r-A'J V-Xn^r-^ (URL) 14, H&£ r S ervice-name : F 
QDN/I P/u r 1 -p a t h j £^oJ$Itf)i<7)T'£>&. tit Hi. r http://www.rn 
icrosoft.com/windows/help.htmj (4U RL *C $>!><, r httpj t V^^T^f-tTX 
r W ww. microsoft, comj fcl^MliFQDNtft 1 ), r w 
indows/help. h tmj IJURUWtfcS. £;WiURL£«#|G*fcU; 

[0023] 

OOa£H^7*n.y?0#*SivO^. ^saaifc «t^M^-->-^^-rA 1 0 0 

Wfctt, lotfc{4S8S<0«fI^«ffe-xl 1 0(4. ^ v-b-^aflfflMaBlfl 20^ 
LTxXtAI 0 0fcJ:oTgflW-&£ ^•yb-^*«lflllfiS*l 2 0(4, 

fcfcitf, JUKI* -y-b-^'l 1 OfcSfttifcAfc, .y-fe-j; 
-twcifcfigtsifcj^-c**. -y-b-v (fcfc;cJ4\ iKK Hlo) (4Bt 

[0024] 

*«yfe-^»ia»J*B*l 2 0(4. »fi^yfe-v\ *fc(i*<D1f7**«y hSr^tttt 
ffi^S 1 3 0 £ i: #T'# 6 . tt8*bffifllJ£SX 1 3 0 (4. 7 4 A.* r- 
, fi^W(2(4X/1A^ai^^(^-g.?t^ ; ^^7h$r4^-r4^^. Ztl?tl<D* 

**fc»i»SK4* ^Hr-SW'Jiott&ififc. J:tf/*£(4ffia6&£iirt:i£ft7ci3 J; 
tf/*fc«3fiI^«teH*f T-*4 ^(4^^(3(4. &fl7C (received 
-from) IPTKl/X. Jgft5fe (reply-to) WfX-llTYls X. cc : ( 
£kx(4\ *-#y3f-) Mfr*-frTY\/X. #8URL {^XYZK-Xt-ft 

V>-7, mm^-Xbt&Vy?. fcitfr** r^©^URL4£(4*<9-$#) , 
imfmmm (tit Hi. WfcxUTa-K) , »4«i£#^ mailto: 
-;l/7 Fl/X'J f^fX h»f f Kl/X, SMTP HEL037VH 

|*]<7)FQDN. SMTP MAIL FROMTHU^/U^-W'WT HI'*, 

[0025] 
[0026] 

a. x. com^'FQDNfi, HRfc I P7hT^«(i'il5Sf(:fI 
■fiik^S*. I P7HUX(4. -it, 40<7)#-f7'o <y?£flM.fcF'y Fft#<0 
l 0jl7*-^-y hbZtii. #7'oy^(4. jSifcJi/MBoStioT^KSii, 
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7'p-y?fi, o*^2 5 5<o$eim^£#t:'#. sfeofcSfrfWi. Wihty?-* 

• yhsfeteWJW-*. fcfcitf. a. x. com(il 23. 1 24. 1 25. 12 6fcS38 
SftS^Ttgtt^fc 9, -3\ 121. 124. 125. 1 26liqrstuv. com£ 

[0027] 

*%w<7)-Bmt,z±titf. mmmmmi 3 cm, ^vt-^i 1 oak***.* 

SMEci PflM8fc*-?< few**. HRt. 4 vf-*v h£itixm 
*fctt*vte-$>#, »41^wt*»«>J8i|^t-^(caMlgii4.-**Wttt. -aw- 

-)V<D\^m^^^Ktz^-^tmm-thc\twx%htmx'hh. iiftw 
^iiB-r 5 - 1 tm^ztch . 

[0028] 

TV^|>-t-A'^±3iL-CV^I>FQDNcO«lutjD^T, ^ ■y-fe-S^Mgft&flfc I P7 F 
l^Xc0l^ij&^"y-b-^^ft7C7>f-^F (-f&*>*>. r Re ceived:j7^- 
;l/F) tf53tKfcftJlTtS. <r<9FQDN«:, SMTPTnh3;^HEL03Vyh'Sr^ 

ZTJ±mwizh&i§j£i,zimm-ic\tt>iX'^\ tztm. t-vt-vit, 5o<o 

I PTKbXi:FQDN^#jD$il^50^fi7cfi : 2r*L. Lfc#ot\ ffj&stfUllSfl 

tz&m mmmi) <ntmx\ ^y^-^e^m^^-^m^tz ( 
x 0^ < tfjnsnfc ) mmiEi-i <r t tfxz h . ^tc^ 7 -b-^^^- 

&**ifcttgtt> ( iOT^rco) S^<3fr££;i*£fc#^?ifcSfctf>* x^A£ft# 

tt, %m%i Pttmtzi*A^j*xv*-i;cD&m%zmi-t&tz#>. x-y^-wftm 

10, trust e ddoma in. com (fl$ST'#l> M-f V ) frt>&iiZtltzi><?>X* 

biij>0X5£.&x.. Ltztf^x. ^•y^-^n^mmmz^x^.m^m^t 

[0029] 

1f-Afc:J;oT*S&i*i4fci&, ILVW P7Y\sXtLXm&tift%>. ->ZtM\- 

m<m<oi P7\ i uxii-tKx. isZT&ftfflw-'Mzxixwz&ttixts*). itz 
ifi-iX. mEZtix^&mizwfohtmb. m&zti&^m&tfh&. fftv^fA 

^<DA;*fl£j£{I^-A<D£j8ctf) 1 P7 Fl^j^iftS^ffett***** 1 , 1 oSrflHfrf 
& ^ <h I. fcrf ?=8^fc*>, itf^Sffrfc* I P7FU*«r rgft#<9j I P7KU 

[0030] 

zjiuy-fWyvryy h^ir^^tw'i P7Fi'A£jiott6fctf><7)io 
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mtx'Z^mm^coim&mzmtfr^x^h^, infirm prYvxz&izt 
h^tifx^h. U»U mzm^-^y^ryb^ vxv-ivztitzxj-u*? < 

h . ^^g*^ft L/i^fi7C<?) I pt H 1^12, JIff#W I P7K I/*-e£>& „ 
1. 2. 3. 101#x. c omfcovvtl*— <0MXP3-hXfcSfcS*UT#*. & 
vvC\ 1. 2. 3. 1 0 lj&»&Jl»t£ftfcff£.totf4£i:fc:J9. »x. com 
^#fi^-^-A'^JE5-r^^i:. L^-jT. Zmnm PTYVXW. x. co 
m£j*fl L/S IPX H UX£*N£-f £ 1 1 i fc #T'# £ . 
[0031] 

[0032] 
[311] 





mm 


Recei ved: from a. x. com 

([1.2.3. 100]) by b. x.com Tue. 
22 Apr 2003 13:11:48 -0700 


x. com(Dl*jfj|J 


Received: from mai Iserver. x. com 
([1.2.3. 101]) by b. x.com Tue. 
22 Apr 2003 12:11:48 -0700 


1. 2. 3. 1011*, x. comic Ol^T CDMX Ua - KT* 

fey, -etiic^y, 3Jw>fT**x.cpmrtsisa>ft$D 


Received: fromoutside.com 
([4.5.6.7]) by 

mai Iserver. x. com Tue. 22 Apr 
2003 11 : 11:48 -0700 


x.comA<^ — v^SftLfcPif Trfe 
&6 3 4.5.6.7£iHl#<7)IPy KUXiLTf 


Received: fromtrustedsender.com 
([8.9. 10. 11]) by outside.com 
Tue, 22 Apr 2003 10:11 : 48 -0700 


C©frtt» 4.5. 6.7T?-y— /<lC«fco"C#IS$n 
fc^^jT'fei)5J^14A<feSo 



[0033] 

is^T&bK MXUa-vmzVzhZtiXV-i&fo&mWfrttMXi/a-FftlzVZhZ 

tix^&wnm:i l zmmizmm-&%>G. ^ta-'j^f^ •/^li^isc-r-g.^rtgtt^ 

Hi-fi. ^rtgtt^ftl. JJEOi 5fcJtott6;hi£aHl#0 i p^«yXfA« 

CO I PTKUX£rt9H: l/ttjKB-f* (fcv^tf>»±, raiPTb'^XOfc 

#>fcW:flUfl$*lT^SJB!irC*6, 10. x. y. z*fc»il7 2. 16. y. z*>6 
172. 31. y. z££{±1 92. 1 68. 0. zHl92. 1 68. 255. z(D 

im<r)i><r)X'hkiphx*bh) . -f^h-h. i>>AT&ft&<?>b'<7)Tvuzi>mm- hz\t 

WX'% h . fif£t , ^faTCtDfrA* TReceived from a. x. com[l. 
2. 3. 1 00] j b^oBMnitCOX'fo*). a. x. c omtD I PT FUX;U-y?T«y 
7>*1. 2. 3. 100£&t*, *4^ti v 1. 2. 3. 1 0 0 <DS£ I P 7 H UX/U -y 
?7>y 7"#a. x. c om££tl>*§-£\ x. c om^cOxXr^t'fcS^t 

[0034] 
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[0035] 

bool fFoundHostlnMX; 

if (external IP address of MX records matches internal IP 

address of MX records) 

{ 



[0036] 
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f FoundHost InMX - FALSE; % it's worth locking for 
} else \ 

f FoundHost InMX = TRUE; it's not worth looking for, 
pretend we already found it 
} 

for each received from line of the form Received from a.b.c 
[i.j.k.l] i 

if i.j.k.l in MX records of receiver domain 
I 

f FoundHostlnMX = TRUE; 
continue; 

} 

if not f FoundHostlnMX 
{ 

fl Has not yet gone through an MX record, must be 

internal 

continue; 

} 

if i.j.k.l is of form 
1 0 . x • y . z or 

172.16.y.z to 172.31.y.z or 
192. 168.0. z to 192. 168.255. z 

\ 

ff Must be internal 
continue; 

} 

if DNS lookup of a.b.c yields i.j.k.l and b.c is 
receiver domain 
{ 

# Must be internal 
continue; 

[0037] 
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[«4] 

} 

Output sender's alleged FQDN a.b.c and sender's actual 
IP address i . j . k . k 
) 

If we reach here, then Error: unable to identify sender's 

alleged FQDN and sender's actual IP address 

[0038] 

?u m\L. ttz\t, zii^z^zm&t&zktfx'zmmytii-yttiimw 
izmxm o m.-ftzMzmzm-th z t & . 

[0039] 

<D7-*T7i-Wk't>L>X'i>7 < }Vf b ixmft?& Z\btfX'%&. ?yJ7yhT- 
Z-f-ti-^xn. i-lfii (tzbttf. X-VyfOXb. ffiA&fc') mfrb<D*-iV* 

-)vr y vxiznvsth uz-ywjxyz, 3-—?tf^mx\ tMtsmmztk 

ffcfl Z b tfXi* h „ Ltzifi^X s X -flT Y r b @ z y x . comj £&t& 

mm%tf3--wzm?* ->v* -v -t-itzmm-th b%th« ma^com?* -)vr y v 

Xb@zyx. corall 3-—f%, r b j b FQDN/ I P r z y x. comj^tf, 
?74 7VVtfvklM% (b@zyx. c om) frbUm* vb-f 1 1 OSr^frt&i: . 
^cOj.-if<7)^^-;krF^XtCOV^Tft^$n.g.)Mfi^ i ;xh2r^t. r b§zy 
x. comj A^Ml!S$ni.rh'^XT'^l>;fc^^-f i *^LT^|.*^9^f l J 

Ltiifi-oX. *vt-WXvt-W~-><lz$mitzbZ, -Ht-fruo 
4$flt (fcfc;tJJ\ jMft^I P7KU.X. MAIL FROM2fcl2HEL07 4-/l'h' 

mmtiz v*h bimt&zbffx'zz. ^m^mmm^^bm^tifz^ 7* 
^^^ryh^-xcoj^irn Y^jv-ttzii^-^-x^v^ruYaMzm 

vzh\HnmmK£tzimft<vmiz$tsb-ikMZhtz*v*-i?{i.. mkthtz#>. * 
tzimcotmxftmztmtitz*). x^tizit^ *fw&gmtt - 

[0040] 

cotzMzmm^nmb^izmzmt^ ; t § . 

[0041] 

I P 7 K . ^ y -fe- >K «y m&MnSftfMr?* -)V7 Y UX {tzb Hf . 
jIfi*«07h*l/Xt?t{i3Mfi5fe7F^X|*l^FQDN±c7)I P;U-y7777°) 
{2, ^•y^-i>cO*^tca^jA^^URLUy^^h'^^y^^I P7 HUX/U 
v9Tv7i**>. tfzitl P7KK*#URL<?)FQDN/I PSMrfc LT.&Wl&*&£ 
fctttt«*£*fc*iM-4.r 4. ttCBKW- 1. £ 3 fc, I P7Kl^(2 
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^mxn, nwmmimmi 3 014. 1 prv^^m^Tum^mi. Mm 
wm*.mhzkifix*h. 

[0042] 

h l^--y^-ri.& ; t^ffi<7)v^r A^rf, 7 ^ h U-->7'ffif&Mm 14 0 
[0043] 

tkiW&fo (deobfuscate) ±MjJEMfct&Zk 2r$St"f S^WSttffi^^ 

ttzimmzm^x. ? ov?*mmhzktfx%h, ^^20 on, tztm 

. 0*>J:5fcjSSL 4fc<4* -vfe-S^fld (Hi ) fcJ:oTIBI««fc*fi.x 

1 o*3^swa«iffli*8B*2 2 0£-£tf. »aa{B«>tAtaB)?$<i3t, tmm 
nmwzmbhmmx y-fe-^i, ^--^mt^t^x^x^ 2 0 o^nrnk-r^z 1 

'tfX't.h. ttdtZtilzftlX , llWWt^ y*-x£&$#|{iltf)fc#>£$ 
[0044] 

1 OS fctt«jft*>*H82 3 0 (mil 2 3 2. *£8 2 234. WKm 2 3 6 k iOffcm. 

fc«u Mttioh^aarc**) ^i^a^ka^-e&s. sftTcttigfi. 

ftt&JBSintz. tfz\tkZ\,zmitZ>ZkifiX% -yb-^^SSIftBBl 
[0045] 

T^Ajlfi^ti. m&M-W 4 >\'?l l z£^XlklllZtL&<7)Z\B\m-&t:MzjEftZ 

«ssu te£if/ttz\ttwmtL£okthm\tf£<bh<nx\ ^rA2oo(i. 
tz+& z t ^m^mmsMiimmm 240 sum. s . *t»iE»i*fci»£g*2 4 0 « 

, Hiai3ftfc*H82 3 0 (fck*tf. FQDNTS)&#\ £*tfi, 7"o 7 ?£J:y"lVIXU 

. aiai sfifcflrst 230 fc^sa j:tf/4fc»4#&rrsc k**?* 4. 04 ^v^±ie 
/4feiiftj?»*«}*LT«fa*jEaiT:-r4;k , fcjtf*ouRL#;*y^>*fi#<^ 

[0046] 

<%K:< k h 2 5 OfcttJBU 7 4)V? 2 7 O&HmtsW/tiZliSmth 

ZktfXZZ. 7 tzkUfxt^y iivftekV/ttzlii/^y?*-^? < 

)V9 k IX&fQtlfcMZ b U-^y^-f 4 Z k fi { X"% 4 . %h\Z. ftZJUmitikx. 

tf, ^ft^^fi7u«^-^TF^x. infill PTHi/7., as^ums*^ 
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[0047] 

2 8 0 tEflttifcfefc:. 4fc»iK#wAy«A»a h 2 8 o K3ajirr4fc*fcttfflf 

#f tf) ij * f &k' , ®%.<7)ttililZtLtz®mzttJS-t Sid fcffitf) U X h £ i k ifi 

o%wt) sasn"*-* 4. ate, iw&wauxMi. »sw 
v>m ) Dmitri z t m-z i . 

[0048] 

JXfc 0 3 - 6 14 . < oA^JBSUcfto T X) N'A^tiJfc i l/GSit £ «Bfcrf 6 

£(4tttfrfl> £ k #"C'£ S W*W&*Srft£*-f . 
[0049] 

03 (4, xmwmmizj: & i pt f 3 o o i pt f 

300<432t*-y F^Tfe 1 ). F>yFtt#10il7*-^-yh (fckX.J4\ -eft-e'ft 3 ffr 
i-C*)47*n-y?T*9, &7n-y?(4t°';7mcioT#8t£*U 3P#/0"/?li 
, 0k 2 5 5^ffl^#tf)ff*Ol^a4)?*$ft*k-f4fc* 7*n>y? (jtktJf, 

P7FU7Jtt4. ^9^.tcioTS*)4. "frfcfctK {-ftphh. A, 

PWI PTKW^-fe-y M4> ft1^kffl<*>23i6I#£#&U ftft<03 2-k (3 231 
<k) ffl^2jtjr?# { JI : S:S«rkfc: ! $:4. UrtfoT, #7*n>y?t4. <e*)&*"3iVC^ 

sgiu^kfla^t'-y hizu-oxmitizt-ifivti (/o 7 ?id302) . 

P 7 F UX 3 0 0 fcBWWt 6*lfc7u y ? I D 3 0 2 *fcj&t 5 fc*>fc, i— f 14. a 
r i n. n<tt%Z-fuv90>f4V9Y»ZW<>tZ.b.1fX!$h. £4>fc, /n 7 ^ I 
D3 0 2(4, 1$8fcl/CM}:Bitfffiffl-fS.rk#"C&&. 
[0050] 

L*»U ^{CioTt4. 70 7 I PTVVZnyiV-rtfftmZtlXVMtZtl 

7o-y?ID30 2£SI^&£t^k#-C£<&V^ <e?)i 5 &*§££t4, 
{4tttB^rA!4. #*<9I PTKUX^OV^ 1 0*^(4^0. 7*Q-y?ID30 2 

fcfc<3J»3ft8kLT. fcil//^7t{4#^yxh (fck*.ti\ raii^^muxh, 
XA%M#f£ijxh&k) ±<Og5gkLT. ^&<kkft*U01 t-yb3 04. ^&<kt 
mXD 2 t'-y h 3 0 6 . 4"&< k t'-y F 3 0 8. 4*5r< & iftflJ<9M t">y h 3 

1 0 (-f&fc*). M(4 1 VlkcmiL) . *$J:tf/4fcU3«Sr< k i*fiJ0> 3 l t'«y h 3 1 
2^T«1"l»-k* i T'#l». 
[0051] 

I PrF^*^<AiMft#Srf&bTV^*\ &l,V^4^A-^iMfi#^bTV^*^J 

^tiztifiTH, hihtbZtitii&ni pt Yis*frb><?)&W)i t* 

•y h 5r JtIS t , ^=5: < k i> 1 o^/n «y ^ I D fcfcjg-f I, ; k S 4 ^ k ^'T# £ 
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^±t^-fl I pt VUxmZtL^i&coteftZtimmz^XtiMl. I PTYVX 
C0052] 

tfz. IPTFUxmm (3 14) £ J: oTjfl£-ri> i'Kchh. lffl 

^iOii^t'^ h^S^IlfcSi|Dlg^>ifc^"e#l». -ecofflt'ti. isp {4y?- 

hfrzofrn^&ix^mx'foh^m.&ipfoh. znivTYisxtK xj^mm^tz 

MlXmU^V I SP^fiJ0ii^tl/i7 r 'O7^c7)-a5T-J>§^. Cfti 

ifc, -e^I PTKI/XA^^°AiIft^SiJO^rtilTV^^t^t-|»±T'WfflT'$> 
l^tt^S . U:#-?T , IPTH U^tftfMSJ?) l ~ 3 1 f •/ hco&« £ . I P T K 
vxm<r>9ti:< k fc^-b-y htf>l&JW8)£3 1 4fcffl*-&*rl*TteJlI'r4£fcfcJ: 0, a 

[0053] 

/ttcimwzmmzmEt&mfttfhh. itztf^x. ^mmn^mx-hi. tan 

WyXT^mtLx. mv/ttzwpKOihi^w) {iztm, wm 
mvzh) <n~u t ixmrn-tz z. t a*?* 4 . 

[0054] 

04i4, tzkUIb. x. c o m^ci: O F Q D N 4 0 0 ^^WM^rt^^ St. 
FQDN400I4, tltlU. HEL07 l -)VYfrh#\&-thc\ktfX'* (tzkUf. 
mm%X'fo&ki. i m-&FQDN) , HRfc* tf*b£4 0 2ti,i:tfM4:'&4 04£' 
£tf. *^h«4 0.2(l -e^J^iixff r b j -c^)l.!f€£03yt 0 a-^5rJ|-r„ h'* 
-4" y^4 0 4 14, 4 y*-* «y h±<7>^&< 1 1 1 OC9§£ffi££(4ga<7)?71^-7V)£lf>f 
*W?tt, r x. cornjii. h*pMy£4 0 4£iH\ FQDN400OPgJf 
C9rt£f4, l*P§4 0 6£=l:-5Til$ft4, £ttWfc*4, B. X. COM4 0 8 (5S£&F 
QDN400) 14, «^WfcX. COM410 ( »#W$r F Q D N ) tZjmt&Z.b&'C 
fcWC, £il£COM4 1 2 (gP#W&FQDN) 

o . #»#w fqdn mm k Lxmrn-fh z t § . 

[0055] 

FQDN400£, (H3fcjStf\fc3fc:} I P7FI>X3 0 0K£$U iiUn^JWSfc t 
Ttt^S^fcttWJrcfcSTO&ttA***. fc^3tf>(4, frU>** H&^K^ y££ 

S. 

[0056] 

zithzktfx'th. tzkm. r a . x. comj fcv^a^fro^s^m*#(4> r x 
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. c omj C0mtJ9tti%?$>& r b. x. comj <aBr##fclf t?fc£^IStt#&S. 
Ltzifi^X. A'^miE%lZ. Wv-k-y*, V*4V404 r x . comjH^) 
iWii&C FQDN400'"b. x. c omj #>^i^T'&l>HIbl><fc 

^{i^^ > At'S>l»^'Sgtt* < J:0iSv^t5-K^-f y4 0 4 r x . comj tfSl/Ovfc**. 
i Lil&V ttfr&T i . -y -b - ^>'7./ V*7 4)V9ZWkttXL&$ TOBtt*** 4 . U 

H^>f>*4 04K:4MIW-4ii:l«rfflT*4. ifcliinfcfti-C, 4fcli£*iteini 

^FQDN400^mt LTttffi-f £. 
[0057] 

mix. mt,z£ ^XZ Uzftmth Z t tfX'% h . &wr\ &&Siifc7.yNV«7^ 
^Sr»»f4Ci:, fcJ:tf/4fctihI'--y^S£fcfc#£t\ #M<7)I>4 1 4£ii 

[0058] 

ft&fc, #f&<DffeH43 1 6. ttzmm^^y&L (±fe@3#aS) Sr. 03fc*J 
I ^T±iE"CiMi L fcJMWfttt -T 4 £ i: £ -I. . FQDN40 0 rb. x. 

coraj <7)*Zh%> r B j 4 0 2&t\ * •y*-i^&Mi3ftfc^£fta<0l!fc£ii 

*4, fL<(«Al*]lt[*lf (fcti.ll «AU-f^/) £*Jfc*4, ifiriffcttift* 
■pMfc#-C#4, US#->T % #U*Mi. *<Oft5&*>»0* i (common 
) Oftafc-frtfifctf?^. 4fcii£*ifcfUT, Hftfc, *fE<t4 I P7KU*#X 

h#T"#4, S&fc, 1S*tf)&iltt (commonal ity) t$J:tf/4.fctt*2l>tt£ 
. ^S^ a 4fc(ift!lO^IiJ^'<-Xi:-ri»^XrAfflc7)SiJc7)#mi: l/CflSJfl-f4.rfcj& t 'C 

[0059] 

H5(i, FQDN4 00^Wt:a—f«50 25ri:'V^<O3&>c7)iaja^)!ttfS^tf. a 
@b. x. comk^om?*-)\sT\!UZ5 00^*®tt$Wl<?>ft®t:*t. 
-A-7Hl/7 5 0 0f±. *yfe-$/*>From7-f-;H«, cc (*-^3t-) 7 4 
-WF\ r e p 1 y-to7-f-^M^« ^ >y -fe- ytt^m a i 1 t o 

: 'J^OVvfil** (tzbltf. mai 1 to : 'jy^Ji, ? V vtZtltltZmfeCOT 

Yv^<n*-)vz£m-mm%m$.w)>7X"hh) s&tflfflwsr*^ 

SMTProh3/M^T1syf!$ftl>MA I L FROMrJVy H*»A>tt{Bf iii:^* 
6. 4fc, S^-;P-rK^X5 0 0(i. >-yb->;<o*Xrtfc:f-^M: LT®«i6 
4. m^Zi-oXii. ^y-t-iWIl, -e^-yfe-^'tClBS-fifcS r r 
e p 1 y all (gJKCjgfl) J 4 J 0 fcgfc#**< fc*>"t*4 "Itttt 

#*4. -e^J: o $r*£tett. cc7^-^Krt«TKW. fcitf/Sfcfi r t o j 7 

-f-^Hrttc:#4^i.rF^xo^^< t ^-m (mw%m%tfvxhztix^zm 

[0060] 



(20) 



#^2004-362559 (P2004-362559A) 



r a @b. x.. comj fc^d*^*-rt'7Kl';* 5 0 014. M« tc^m&tzltT&g. 

ft^Wttt. «^-^7Fl^(4. 3-~f£502fc. § 6(CiIffl*>ttS(SNI# 
-fb1"l>Ct* { T-#I.FQDN5 04 (£t;ti4. 04OFQDN4 0 0#f8t) fcSr^tf. 

^X(4. I P7Fl'XTtt£<FQDN*ttffll/C*ieS*U. 

[0061] 

itfDWCtt, r a @b. x. comj (4. ^--if£502 r aj £#if. U;^t, 
r aj £lo<^S£LTttaJtS-i*^'#6o FQDN504 rt>. x. c 

omj t &%<ti> imm<wmt LxmFf-^-ivTYvxt^m^i-h^tti^ 

■6. H^-^7KP*5 0 0«0FQDN5 0 4g|tfH4, H4t:*3^T±IEfc «fc 0PL< 

mm rrnummt ixmtz - 1 & . 

[0062] 

06(4, *JMB^)!BWfc:J:40!K5«rt:URL6OO (fcfcitf, x. y. c 
om/a/b/c) fc. *C^^«iasS^«R^)«fai:*7irr. URL60014. A v 

[0063] 

URL(4. I P 7 KWXfcOV vt Lfc i: ffitt*:fr&-CflJiR*frr S £ S. URL 

600 mmt-t&miz^ t-r . utta* htt P: //, htt PS: //. ftp 

://. telnet: //=3ri:ffiEc7)&ISiS (tiktli. -f-t'x£) im&t&Zb 
tfX'%1. r§j (fciitf, 1 6jt^iet'%4 0 ) ^"URL^^m 

gM (fcfcitf. http : //) fc r@j fc9«>iaHcirx,fci*>#*oTfc 
£ £ . <Hl*»& U R L 6 0 0 ZiEMittl Z t tfX'Z h . X^A&ff 

[0064] 

£££(4. http://www.amazon.comei21.122.123.124/info.htit4. X -y-t— 
£-?T. dW-^www. amazon. c o mT'J>S*»<7)4 0 !>„ Ltztf-o 

a^x^-xKttffrf !> r 1 2 1 . 1 2 2. 1 2 3. 1 24 j U&»U 
4^>T(4, S»n^>f y^safci-rsfcftfc. *%?)i*fl##. URL6 0 0<9<r<9g&# 

[0065] 

jfflitiiXXfWmMLtimz. URL 6 0 0(4. *Mmzx. y. c om/a/b/c 
tlXm-ZtffX'Z. fcfc'U x. y. c om6 3 0(4g^)£ir (FQDN) T*2> 0 
. a/b/c (fcfcitf, &%i§) {4«t<^6aLhW7T'f;K0fflirC*4. x. y. co 
m/a/b/c 6 0 0**X^AiS<g«SrflWiH-i*-&fc:tt, x. y. com/a/b6 1 
OfcctV'x. y. com/a6 20i,H^. l»Iti^(4M«-rSXA 4 Aiiff#$:iKiJ-r^ 
TSTigtt^ftfc*^. URL6 0 0^*Sa5^^/c(4A^^x^(4 lftfcl 

oc7)gp^*^JS§ti. fcfc*tf» ^fi){^Wv^TA^^(4 l JXbfflc7)iIi!jP^f^S:#l.- 
tirXZh. ZtiizXK). ^XtfmgAz^?-yiz%m>ti%^£ott&XX^J±& 
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[0066] 

mm&wto#2tvtzt%> m4iz&\,*x±Mi!xmiitititz. fqdn63o££*> 
izmxmi. mawmift&zbtfX'Zt. mxmsizts^xmux^ 

ZXolZ, FQDN6 3 0i>&tz. I P7 VV hZbitX*** Itltf-oX . 

i PT\ t \>>zizmm'm«%mki>£t:. mtt ixmtzzttfxzi. 

[0067] 

H<0!ii'«URLIl nnn. nnn. nnn. nnn/a/b/cif, FQDNT* 
&< I PTYVX (fztUi. K-y hft# 1 0it7 *- v-y h ) T'iej£§*ll>. JgJIfgii 

r CJ t-^^§3i^-ri)Ji#m*-ri»^i^T'#, &mx\ mtii (mm) u 

RLSr^fc LX®MfhZ\ttfX%h (tztUf. nnn. nnn. nnn. nnn/ 
a/b, nnn. nnn. nnn. nnn/a, nnn. nnn. nnn. n n nil ~f 
KXYvVm 1 0jt7*- V-y hcOURL*^tttBf S^t^lg^itT'l)?.) . 51 
£igivt, (fcfcitf, &Sff§i:&fliIS#^) I PTFUXiH^ LTf£ffllT§£i: 
%<n\PTYV*Z%<7)*vY'?Uy?\,Z-?>vr'$hZtti i X%h. 
* >y h 7o •/ ? * J 5I!2-C'# & V ^§-££f 2 . I PTH UXOfift?) 1 . 2 HftfcXO 3 1t'-y 

btx'<n&«zmv>mktLxmL. nmmmti^i^x^h (H3#io . 

[0068] 

K-y 1 0jt7*-V-y h^jDfC. IPTFl'T.li, dword (^V-F 
) 7*--?-yh (fcfcitf. ZtlZtLl 0it^-C2oc01 6h*>y hfrMr* 2*7-1* ) 
, 8a7t-?7f 8*8) . 16*7*- Vvh (tztm. 1651ft) 

IB (nni216«TV)tt) fcttJfll/Car^fW* £ t fcJ 0 . IPTFW^ URL, 
ma i 1 to : >Jy?, t5*V/£tdiFQDmT*Jim:t ftTOt****. 
[0069] 

if . URLti r www. intendedpage.com?www. actualpage.com. j L 

tillSWM. 7'77if{±H^ r WW w. actualpage. c omj £ 
^LT&9, fSSiVC^S r www. intendedpage. c om j T1£5r< 
O^-^to-H-fS. ItztfiX. URLftlziz£ti2>^7*—?i>£tz^ W&bLX 

mmthtzMz^m-^ z t h . 

[0070] 

mis awwsicftoT^^iwrp. *jii^/4fc<i» **mmz7f;ztimwzti&h<o 
frbnnnmfttmmzfio zktfxz *mm. mtiwwfiz£^x®mzti 
zvz.b&mztit:^. titux. imt. Mzitix. tf.mm%k'~&?>wi5.izm 
imhimttzmmt Lxmtz t w?*izt m^mmxt hxhb o 

[0071] 

n*X7 0 0<97O-^--r— b^^irf. 7ot^7 0 0ll 7°D-te77 1 OX* vt—i' 

(fctttf. 'j?%<ti> loco^-y-fe-v 5 ) ££m-t$£fcrra*frrs * 
, *£*»Moafctt«»^ira*ttaw-4. t^-c&, (Hi ltc^wc 

TIE*)) 7-0**7 2 5?$ £>£f¥L<»tl>. ^fS<O0!fc:tt. received f 
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rom7-(-yl/b\ rep 1 y-to7 4 — /UK, c c 7 4 — /H<, ma i 1 t o : 7 -f 
-;H^. MAIL FROM SMTP 37> H, HE L07 4 -/H*. r^* hfliC, 

hftlztiXt&HM (Kb Hi. Mmcoi PTVUA) tf±tix&. 
[0072] 

4. 7°n-t7.7 4 0T\ ±IE(^ti.(i\ 7°o-tr7.7 10. 7u-tX7 20, 

«H«¥®7 4 )l?%b~7 V--V?~$h Z b tfX'% S . 

[0073] 

wztLixoiz. z^mm, z^^z-thtzwzmm-fh z t #-c& h . Tf&sooji, 

81 0T^yb-ytftflM-4ikTIIM«J#l4. 7o-fe.X8 2 0T\ HI lfcRBILT 
felTttlWH-S <t o fc, 1 WHSSR^a^^ y -fc-S^&ttHiSfl* . 7°n-bX 8 

-f^taaW-'i. flfcgwc, r^y^j r^N'Aj Zb'co'flfe, &MZs<vt- : J 
[0074] 

££1£#7.aa ££<2TO4#fg^) k^Hi§ 

fufcSlI* -y -fe- iSftX'^Zcomilzm^ vc y x h fcfltiSU **o y X h fcffiSf * fc- 
ft^J^ffl&7n*X9 0 0<97o-f-r-h£^\ 7°o-feX900(i. 7otX9 1 

•y-fe->'*52Hi#*> I PTKUX^i:'. U<o*>^B ZlxhW&imti&lxh 

J:oT7.y^A4/i{i^7.yN°Ai;^-r^^i* { T'^l»„ TO-trT.9 3 0T\ 

*HH (tzbm. z^Attzimz^j*) izm^x. mmmMzx^xtm-thzbtf 

7n-fcX940T\ HKWfct^Ttf)* vfe-5># (fckitf. 7'DtX9 1 0 
, 7-n-b7.920, 7o^9 3 0-C) W®%tL&tX'mmtZbtfX'Z *<Qfc* 
7cHrX9 5 0T\ Hm<7)VA\-*ft&t&ZbffX'Z&. Kb Hi, 9 0%fSJS&L ( 
fcfcitf, ^^^«09 0%^7.ys'A N 2£{i*fMy*-x«9 0%T1M.^A) -CA 
P7Kl/Xfc:oivt, *4 'J XhSrfftft-*-*;: f§J«tC 90%B 

% (xnj±) X'hhWSMl PTYVXlz-o^XtWxYZftffct&ZbtfXZh. n 

®<7)nmx\ mrtamzo^xibtnvA viftm-hzbtfX'Zz. 

[0075] 

ztiwvzh usmtzjmthz b tfx-z tzb zmMZti&\ -r&*>*>. ztih 

<7)U7.h(i, *rU\X v*- : J<7)mw7)U-7tfW!mZtitz k ZWMit&ZbPX'Z h 

^<7)flbfcSB#^T\ IfyxMT»S«*^S. k^3«0(i, -SPOX 
'■u&mZtf (Kb Hi. ? 4 MKWl&t^Mn r ft!®J ^flSfeftt) ftttfcPMi 
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$>!><, 
[0076] 

tzMzmt&zttfvzt. %co£o%i>cote. mi oxmzmm^ti^mm^ru 

-IrXl OOOKJoT^SfrO^. Ml OlZktUf, Tn-lrXl OOOfi, 1 

o i ox'*v*-v*%mhc\tiz£'>xtefohc\)itfX'*z>. tv-t- it*, tztt 
if, x^Attzii^j^Ai^mtiz ttfX'Zi. ro-txi 02 ox, wsmza 

7u±Zl 0 3 0X\ te&Ztltzmi&£V : *v*-i;coftmtfhU-->7m*'yhl,z 
[0077] 

®fi r 9 o %^ii=5r L U x b j k%Wt-?X'foh. 7°u*.x 1 0 5 OX $ftrr4Af"y 
7" UzkZX£. rn-fe^l 0 10. 7°o-feXl 0 2 0, 7n-i:Xl 0 3 0. 0 

sgmzm^xmtRZti. mm^Tfua-yxAzmix. x>*j±7 4 >v?%}£7 < )v 

?t;b]/--y7t&tzMZim2tl&. 
[0078] 

££>C. tit HI. rXh*7-fc->\ •rUvx-y-fe-s;. *$J:tf/ifc{i«l*>U\x 
vt-i/tttMt UzMZ. IPTYUZnmmzbZffim-flZktfX'Zl. L*vL 
. ;*>WCI±. iP7FUXifWi»a'Cli*V\ tfL6 I PTH^^fi^ltStTfc 

#x#i>. 

[0079] 

0 0. ro«800. 7°o-fe^9 0 0. 7*n-tXl 0 0 0CH21/C. * «Hs-5*0»6 
Itaiftaj-fSW^W**^ 1 1 0 0«7n-f-+-hjj«j*S*i-CV*4. 1 OOJi 
> 5M17EI P7K1^2££*tf>-as#£8iaiU ro-fe*l l l OfjEfflftUtBIBM- 
SvIi:aX£4. £tz. 7*0**1 1 1 0X tnttKlPTVUZfrkffiMMWL* 
m&t *<r>\ PTYUXZt'v b& (fctltf, m3X'UmiX^Xo^ ft 
=fijtf> 1 t* 7 b . J1UJ<0 2 f 7 h ~~m%)CD 3lh'ybtX') COimiZfrlil Z k &x$ h . 

$MZtiX^&mm%V>*Ab%,i>£t:. rn«l l l 0"Cffiaj-f-S.it^"C 
*S. jESftS^*ffi^IPTH^feJ:l^«*Xb*<0«ra»*, 

s^f-AiWiRBS h u-->7m : sZTJ±<7)ftmtk Lx&mh z t tret & . 

[0080] 

•*r^3y"C*63&*. 7*D-fcXl 1 2 OfcX rprom: J firWrtSSrttSifeiV/ 
ifcttEIflsU »K#afcLTflM't4£i:a < r&4. rn«l 13 OX R8(c r 
MAI L FROM SMTP j IX tiffl? X 

V/* tASSMCth z\ k tfX'Z h . 

[0081] 

&vx. ioowi^v p<y-b-s;rtfc***L4iirsBtto*4ffi<o^n8* 

ftfiteSWM fctf-CS S. fci: *7V 9 yx (#gfc#&> 7*o-fc* 1 1 4 0 fc 
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1 1 5 Of. cc7^ -/H*Ort®3\ 4«fir< 1 1 1 0<7)#mi: IxTttJf* S^ftt^r 
^9^"C»ajfci:V/43tlijEa'fW4ii:3& I "C'#4. /oWl 16 Of, ^ftfittttiS 

mttch. aa^PSflBSif^^ 7t-5^cW6«^. ro-bxi 1 6 0t\ 

[0082] 

N«(C. *7~s-iVX\ lo^d»URLfcii;/i^limai 1 to : 'jy? 
. $>4C Ztl^tlTu-bA 1 1 7 OfcitfTu-feX 1 1 8 OfcTMife 

, URL07T^U») £jWt4£fca f, C*. URL<7)FQDNgP^O*^#(t^ 

wmnrnzmix. l^ttzumwrnuRLmbtih. «hkjrl»4, *m 

[0083] 

(fctitr, 5feKas?sfirv%4, ifci4«e$*iTv»s) ^-v-v&xxs/ttz 

Itftem-Zbtf-CZi. WI^B^tA. 4fcliU^h««». 

[0084] 

-^rfbrfi^x'^-rtfrw-^zmmztLi-simftmi. * v-t-iszmwt 

received-from?^-^ FfcflHrti . jfeKW*Sflfc 
iV)?Sfl7c7^Xi{fIE74$t££*L-C^4. ^^ASfi*tii^«l6 

zmm-t&zktfx-z. *<r>m&£v/&tz\mmmfr&tz#>, 

<OjU<iag(C-5V^-C5Ht#*JR<teAs ftftWTKl'** received-f rom7< 
— ;U H C:A7j74 £ t tfX*% 4 . 
[0085] 

111 2J2, *fl^-yt-i/'C0r e c e i v e d - f r o mffltffliM (itt ilf 
. WJ±mt%) <r)VrfXflr-rt I PTb*^*K8l'f6fcft<OW*W ! Or7'o-b^ 12 0 0 
<7D70~?-^-h&jjrf. #JD$^ r e ceived-f rom7HI/X(t jij0$ft. 

fcjfijfTSS^s <r t i?x-% i (tzkia. m®<7)i><?>ffmh&8.muztitzi><?)X'b&) 

. LfctfoT. 7d«1 2 1 0X\ -iK02HiflW-A*l PTHl/^SrjBo 

TifiBU «fiW)fS«S<tS-9--^I P7Kl^£&5g-f4<rfc#-e#4. To-trXl 2 

2 0T\ *&4><I8l$*l4-9w , n P7FP7. (xXrAO-f <C*h!l?>*>0)) «^ 
gyXfACi o Tfliffl$^ft«Nai: LTttft-f 4 £ 4 . ikftWfiSSil* k<7) 

I P 7 H ij x h liZVOStti -I t i WC** . 
[0086] 

7*0**1 2 3 0T\ ±K§ftT^4i8»&tf)FQDNi4fc. 
4*\ -Hifc i>*/N'AjIfi#t'S)4*4'J^1-4C:t fcSM^tSfcfcteJfcB"*"*^**"? 

FQDN fcHlMNW"4 <^ t ^ 4 "C# 4 . fcfcitf, ±5i$ilT V^4 F QD N#a . b. 
c. x. comt*5i:ll»f4. «r<50±3i$ixT^4FQDN{±. b. c. x. com 
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-»c. x. com^x. com-comSr4littSJ:d^T4M»Sfl4»±i*C*ft. I 
tzifi^X, #»^FQDN-b^>'h*4>^fcft^FQDN*8iJ<Ol*ai:UTfi!flBU. ft 

[0087] 

flj&i^i: LT* »yt-^4WaL. ^a*W^3 6 i fcfc* 

-^^rtcOr^^h fc Lt\ URL^ ■yte-v : l*I(za* F )3 ! iilT^-l)"rtitt^J)l> 

tf/*fcl»WU RL 'JX Y<7) 1 o*fcli«te £Jt$:L. *>£ W*7VV*Mm% 

T\ iOiHSfcL WlyXfArtt. ifctt*3f8y*h±T\ asuH^Ptrcil 
jDco#®t LT ttffl-tS i i: h . 
[0088] 

ftWfi^W&To-lrXl 3 0 0<O7n— f-^-h^SflTV^S. 7o«l 3 1 0T1 
fitf).X-yfe-j/*£»ILfcftfc, ra«l 3 2 0T\ URL, mai Itoi'Jy^t 
L<(ima i 1 t o : U K»R<Offitf>T*.* K ifcttURLfl-aMteSafrC-eo 
^ vfe-j/*^jaetiCi:**-C#4. ro-fe* 1 3 3 0T\ * >vt- : Jtf±McOk'h.fr$: 

Ltf>L. ^ y-fe-y>'-e^id^#t4>ni»^ 7-a-bX134 0t% &fcB§ft£#$t 

[0089] 

rn-txi 3 5 0T, ^ryy^;i4iJfliy7.TA(i. uRUmaiitoi'jy?, 

URL-f-t'^. URL/^ FQDN (fctitf, URL, HH^-fl/TrU*^ 
^FQDNgP^t') ^10^/ii±^c^T-^ / <-X$r|i|K|, l rt^j:i9. ma i 1 t 

jTCUA rft&gffj , Jiff, t$J:Vfl!W)R««rBtt<%l^r<kt lot*tffc 
nbLXtimt&ZbtfX'th. %V>£o%%m,±. ro-fexi 3 6 0t'iiJa^^NSf:L 

, isn$<tfe7 iwmmt&tiMzzuzmthzttfxzmmmi.x'Gm 

[0090] 
[00913 
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[00923 

Zteft^&tztbcDm*#)tt:7'v*A 14 0 O0>7n-f-*-h£jjrf . X^i»jMfI#i4. 

WCj&»£>, i^(4^(4a^^TV^o/igS^^URL^^r-tl,^-^Sr')Ifi-ri> 

fl7Cl URL, «^-/P7Kl^ tOM fcovvc, 

iHTf* 
[0093] 

/DtXl 4 0 014. 7DtX14 1 0T\ *ff.X ■yfe-i>a»&0) 1 o4 fcli*Rtf>ft 

&. ro-bX14 3 0T\ Z<7)*vt- ; Jtf&nX'&\ ttdtZtlllb'&MX"%^ (fc 
fc;tf4\ SattWeeStfeLTV^^) *§£Cf4, 7°o-bX14 4 0T\ -e^iHiSril 
jDWRrfSi: LTffiffl-fSC^^'T'#5o ^dT'=5:V^a4, rn«14 6 0t. 

[0094] 

Zmmt&ZkffX'Zl. S3fcSt4, -f^XidC^X^tLX^l. mw&Mb LT, 
add-raachine-f eaturesUdd-ip-f eaturestU3 2 
ocoraiS[^fR3-H<7)*^T€«$^TV^„ rpREFIX-mach i ne-MA 
CHINEj 0)43&flfS£«ffiU PREFIXS9Rrtt:ftSt<0*«r m achi ne 
j fcV^#Stca9SS*l. ^CTmachinej fc^3#g#MACH I NESSftfi 
t*4 fc<*>fcifiS$iVCaiJ«3fUt;* h 'J >7Z*i-. &mz, M%.a dd-to-fe 
ature-listlt J%&<7)* >y*-i?lZtmmt>tlt:®m<7) > J XbM^tl 

att. 

[0095] 

[0096] 
[H53 



f for a given message, extract all the features 

IPADDRESS := the last external IP address in the received- 
from list; 



[0097] 
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-[*6] 

add-ipfeatures (received, I PADDRESS) ; 

SENDERS-ALLEGED- FQDN FQDN in the last external IP 
address in the received- from list; 

add-machine- features ( senders fqdn, SENDERS-ALLEGED- FQDN) ; 

for each email address type TYPE in (from, CC, to, reply- 
to, embedded-mail to-link, embedded-address, and SMTP MAIL 
FROM) 
I 

for each address ADDRESS of type TYPE in the message { 
deobfuscate ADDRESS if necessary; 
add -to- feat ure- list TYPE- ADDRESS; 
if ADDRESS is of the form NAME0MACHINE then 

add-machine-features (TYPE, MACHINE) ; 

else 

{ i ADDRESS is of form NAME@ I PADDRESS 
add- ip- features (TY PE, I PADDRESS ) ; 

} 

} 

for each url type TYPE in (cli ckable-1 inks, text-based- 
links, embedded-image- links) 
I 

for each URL in the message of type TYPE 
1 

deobfuscate URL; 

add-to-f eature-list TYPE-URL; 

set PARENTALCLASS := parental control system class 

of URL; 

add-to-f eature-list TYPE-class-PARENTCLASS; 

while URL has a location suffix 

{ 

remove location suffix from URL, i.e. x.y/a/b/c 
-> x.y/a/b; x.y/a/b -> x.y/a; x.y/a; 
} 

# All suffixes have been removed; URL is now either 
machine name or IP address 

if URL is machine name 
{ 

add-machine-features (TYPE, URL) ; 

} 

else 
< 

add-ip-features (TYPE, URL); 

[0098] 
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[H73 

} 

} 

) 

function add-machine-features {PREFIX, MACHINE) 
{ 

add-ip-f eatures (PREFIX-ip, nslookup (MACHINE) ) ; 

while MACHINE not equal "" 

I 

add-to- feature-list PREFIX -machine -MACHINE; 
remove beginning from MACHINE if (i.e. a.x.com -> 
x.com, or x.com -> com); 
} 

) 

function add-ip-f eatures (PREFIX, I PADDRESS) 
{ 

add- to- feature- list PREFI X-ipaddress- I PADDRESS; 
find netblock NETBLOCK of I PADDRESS; 
add- to- feature- list PREFI X-netbl ock-NETBLOCK ; 
for N = 1 to 31 I 

MASKED = first N bits of I PADDRESS ; 

add- to-f eat ure- list PREFI X-masked-N-MASKED; 

} 

) 



[0099] 

fcHWH-ifcofc-t*. *mnzi^x. l^tiziXmnzytA-ftMtibVT'* 

^^zx^xm^^titr^^y^^^-^y^y^^-^mi^^^-^ 

/* fciiA- h *t x r t v 7 b *? x T<m&tt ixmmh z t tfx* zzbz.m 
%x°btumMt&zbtfX'%&x'$>*>d. 

[01003 

tm&y*$ts. mrnsn s i on. ffl&:m<tmm--miz-?%'-?. *wn<mmz 
tz\mi&»^z^xb^*jMmm*L%\^<r>b~?z>. *%mbmzmi-z><Mz 

®LX^&^m&Wfo&Mcr>ffl%icr>3y't°j.-?yz'ri±, Wx., toXV/ttzlM&lz 
xtJ*. TvfyAmmWim. *«y 1- 7-7 PC. j>M y7W-i* 

[0101] 

01 5mm ib. *m^**nm*mittiizto0Mmtwti 5 1 on. 

aytWl 5 l 2**//CV**. aytw 1 5 1 2(4. &l$g£l 5 14. 
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r^t'J 1516, v-XtAvn'X 1 5 1 8££t». ; yXf^^X 1 5 1 814, Ztitift 

izimt>%^tf. wA^ty 1 5 1 6£$ti : s*Ti>ffif8gfiiz%tmms.i 5 1 4fc 

fe^tS. MS^Sl 5 14(4, ^^^ffl^ISI^ro-fe y^V^^^-r^Clt^T 

*!UI$gS 1 5 1 4 fc LTffiffl-f 5 £ 4 . 

[0102] 

y^fAA'A 15 1 8(4, .X* ';^Xtt<(4^t l J3yho-5. fflsawB/^fcL 
<ttjWtt, «4^yiJt{4ffiS^^ : 5:«ffl^'^^T-dfT^^^Sr«ffl-ri>n 

**f91-*r\Z\t, ZtltzmzlZm^^K 1 1 t'y FA'^, ISA (Industr i 
al Standard Architecture) a'X, MCA(Micro-Ch 
annel Architecture) EISA (Extended ■ ISA) 
A'X, IDE ('Intelligent Drive Electroniccs), V 
E SAD-*;WU (VLB), PCI (Peripheral Component 
Interconnect) . jl^v?— tt^^T^X (USB) , AGP (Adva 
need Graphics Port) , PCMCIA (Persona 1 Comp 
uter Memory Card International Associati 
on) SCSI (Smal 1 Computer Systems Interf 

ac e ) tf^ttlt. 
[0103] 

^fA^t'J 1 5 16(214, mm***) 1 5 20feilPPW«tt^^'J 1 522# 
*4*i4. ^^t't^ytji-^ 1 5 1 2rtiOS*S-C-it#&iEM-ri)S*^-^->' 
t*tHi*AtBA^"fA (BIOS) (i, TOfHfcx* L> 1 5 2 2rtfclEtt$*iW* 
. RagTJ4=Sr<W**{f4fc. ^JW&tt-X^'J 1 5 2 2(C(4, RfflU»ffl^*y ( ROM 
) . 7°n^7A^Tfg'5rROM (PROM) . amWTn^^Anltg^ROM ( E PROM 
) , l^W?I*«I^ROM (EEPROM) , 4£(±77 -v S/x**: y#-£4*l&. $ 

fMt-xtu 1 52 ocii ftmv-yis^tviixmftt&yyy^Tf-txxtv 

(RAM) tfe&tll. mfeX'li%<m*mf&t. RAM(4. ^t^7?RAM (S 
RAM) , ^Wt5v7RAM (DRAM) . yy^ntXDRAM (SDRAM) . ^ 
7*/l"r— r- SDRAM (DDR SDRAM) , E SDRAM (enhanced 
SDRAM) , SLDRAM(Synchl ink DRAM) x M h5J*'*Z 

ram (drram) mL<m%x-mmm:hh . 

[0104] 

mfcisti. 01 5«4. ^fcxtf. r^^iEflaiMi 5 2 4**t. T<xni*mm. 

1 5 2 4(3(4. *ft£*tfcttR&*rV\&«, llSvf 4*?K7-r 7\ 7D7f- (S&ffifl 
) f 4 7\ t—TYJA 7\ J az K747\ Z i p 7*. LS-100 

F:M 7*, 79yS/a^t'J*-H» ^t'J-^f 4 * ?<04 a %t'W Z&ti£tl& . 
Sfcfc, r-fX?iEttSSai 5 24(3(4. "tfitfttfcttfiRW^ 3yy^hrV^7 
ROMfA'^f^ (CD-ROM) . lEIMtg^CD H7^7' (CD-RF7-f7) . 
ji^lE=5rCD H7^7* (CD-RWK7-f7*) . £tz\tr : J ? iV%m&f < ROM 
K?-f 7' (DVD-ROM) fcWfc?* * *7 YvA 7££*yc. SEttttftaWiflfflC* ifc 
t4fl!i<Oiett«*fc^a^:-C*4it«^rigtt* , *6. T-fX?f£1iSSl 5 2405'Xt 
AA* 1 5 1 8(33tt&tglf£^(3-f &££>(3. 4 y?-7x-7.1 5 2 6^i'ML 

[0105] 

HI 5(4. a— ft, #»5tffrftSWtl 5 1 0fc»B^§ilS**W*3>lfa-^*aB 

l\ -c<04 3&7 7 r-7x7(3(4. ^U-f-fy^fAl 528*%4*l&. sj-^ 
U-r -f >7i/XT& 1 5 2 8(4. r-r X7iS1g§SEl 5 24(3iE1£tSC:t#T , #, 3 
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ybTa-^XrAl 5 1 2cr>m&%WL. m*)Wtl>£o£We*i>. is AT&T? V 
y-y 3 yi 5 3 0(4, WfA^t'J 1 5 1 6fl£fcfir-r*?!eii^Sl 5 24£tE 
ttSnfc7 , o^5Atv'*a-;H 5 3 2*3 J: 1^7*0^7^-^ 1 5 34£tf-LT, 

[0106] 

JL-f-'(4, A^T^M^l 5 3 6£^L-C3yt'a-?1 5 1 2 C:3-?y K4£(4tif$B 
£A;>rf&. Atjt^t,! 5 3 6(c(4, Wi(t£(4Rg<o&^#', v^t'^yf 

^y^'f^T., h77?#'-/K X?^*, ?>y-fA<yh\ ^f-tf'-F, 7i^D7 

*y, xa^f^y^, itA^t^ryft, x^7, tvk 

, fcJ:t^A7JT^MX(4, 'f^-7x-X-K-M 5 3 8^Lt> y^fAA'x 
1 5 1 8^Jitr«raHSl ^WttWL-th, 4V?-7x-XX-Y\ 5 3 8C(4, 

(USB) A«*4<tS. [IITJtWTxI 54 0(4, JJlT'U * 1 5 3 6 i: PI tMOtf- 

tA^S-lStt-rS^fc. 4fc, 3yfi-^l 5 1 2frt>ftJlT'WAl 5 4 0fcfflf« 

£a^&£^£teffit&^fc ai^wr? 1542(4, aj^r^^i 54 

4 1 s tt,J]T?T? 1 5 4 2 (3(4, iWJT^M *1 5 4 0 1 5 1 80fST' 

[0107] 

ayta-^l 5 1 2(4, iJt-haytW 1 544&fc', loifclilSR^y* 

4. 'Jt-h3yta-^l 54 4(4, A-yf/^yt'a-^, -tfw?. /P-?, *-y 
h7-7PC, 7-?xf-y3y, •e-f^orn-bvtt^-^fcf***. err'* 
-^x4fc(4^t!!^0aiS^•/^V-^y-H^i:•t•rl)ii:* { •C'#, HRK. rjyfa-^ 
1 5 1 2fcWLT±ifiUfcS8IW^»*fct4^»t*tr. M*fc"**fcftfc. ^t'JIBIt 
gfil 54 6WJ ; e-b3yfa-^l 544k^K*Stl-C^S. 'H-b^yf 
3.-9 1 5 4 4(4, *>y YV-IA y?-7x-7.1 5 4 8Sr^LTnyfa-^ 1 5 1 

2tiaa«(c«a$fL, <x^t% sifi«Mi 5 5ot^UT««wic«isii4. i* 

7-?^fy^-7x-Xl 548(4, D-^I'J7*» F7-? (LAN) HXXftiM 
*yb7-7 (WAN) jM*«y hV-tZStS. LANftffrfcte, #7r-f-rt# 
*T-^'f y^~7x-X (FDD I) , mmT-fi4yf-7x-X (CDDI) , 
(fMiiSS) /IEEE1 102. 3, h-?y ] J V7/\ EEE 1 102 
. Sfctf^SfU. WANSflftfcL -HirtfWcttR&fcVMp, • • 

yh • 'Jy?, ^ri^/WIfflB < I SDN) <r>^tmmm-~>Yv-?h*:<rm 
mm. rttrvhy&frvhv-?* axt/T^^Mxmmw: (dsd tfettn. 

[0108] 

If^l 5 5 0(4, *>y h7-^>fy^-7*-^1548^Ul 5 1 
&£ft(Zffiffl$ft&A-K7x7/V7h7x7£^-f. SfiS^l 5 5 0(4, Htfjl^ 
tUj:5(:3yt A -^ 1 5 1 2*>rtffl?*§frtV>£#, 3ytW 1 5 1 2<7tfMIJ 
fc-f&ifctf^S. «St*BWfctSP8rV^, *>y h7-?>f y^-7x-^l 54 

8 iztttmMiz<m& n- h 7 x 7/ v 7 h 7 x 7(;(4 , a»<ofle8tfA, 7--7 

/I^ErAtiitfDSLtTA^tftTA, ISDNTrr^, fc4>tflC>f-'**yh ( 



(31) 



^^32004-362559 (P2004-362559A) 



[0109] 

MzmfmrnttMummi ^ti^h^m^z^xmm-tt a t imffix°%< 

oft^H, tEE, *3J:U^^®2:-t^-C^#-tl.tOt^. 5 6fc r i n c 1 u d e 

«fc 0&fflt§(±. rcomprising (^tf, I-tS) J ^fitft^&Bft-ClSJ^ 
kUTttfflS*utk**RS*L4J:'3t r com P risi ng j kv^dfflafcHHUcft 

[0110] 

[Hi ] *«!)l«>lft&£ X h . xnj>m&£%9feth isXr^mvovyu -y mx 

[02] *%>wcr>mmz£z>. mm* 'v^-vfrhi^twmm.^mm^-fh^'t 

{z£^XX^J4b±.Z^z^h^x^J±<n7uv 9WXfoh . 

mx-foh. 

[[14] WJo^t: , F QD Nj&^ttttJ^I. - fc 

[H6] *wwamzs.t^ \iRi,±tz\&*7TY\/xfrhmitz>z.tffx*h& 
mnmwmx&z. 

[07] *aHj|oJB8fcJ:4, 7 0l'*£hl'--:'^S£fcaRI*^&W^fc3ri£ 
tf)7n-^-\>-hT"S>l>. 

[H8] *&iPitf)JB«£J:*. hU--y^S#ifc7 -frt^MMf'iifcfcflBi'f 

[09] *&Mom!£*&* ^xv^wmhz^zmmthm^m^m^y^-i- 

*-VX'bh. 

[010] 1fl&WmfcXh* 7 < >V?ZYV--V?~$-%tz#>\ l ZV XYZtiffif hZb 
lzffl&t&ffl^&}%:1]&<7)7 o-f-*- 

. [011 ] *^HJ^.m«t i 4 , £ t>07t3«fct^08cO^O4'T#BS$^X^ 
70— f-v-hT&S. 

[012] *fHB«0!KKK:J:4. *fti:flM»«0j|fi7C (received-from) IP 
TYV XZm\WhZ\t*^Z-?&JM<r)7u-^-YX'foh , 

[013] *»BBw»*fc:J:4, *fl* v±-i?frhm&&J&&£V/&iZ\m£^hWi 
lZ^7Uy?}lfflffl~/ATJ*t:m&&ts1j%<7)-7V-* J r-}*X'bZ>. 

[014] ##DiO!B«te«l:.&, «I^S^TArt'C«fflSii6«pa-fe«yh^jSt«l5 

tZ-f&J]&C07Zt-j-^—hX'$>&. 

[ 015 ] #&BJ!<7)«* *JBK*IUIrt-4 fcfca^W&SWtoEI'C* 6 . 
[0111] 

iio mmx-v-t-i' 

120 ^-yfe-^5Wt»lSa* 

130 ^saiiaj/^HWEflijjtSR 
140 7 4 ^ h i^--y/fiij£g& 

150 hW--y/$fut7-f;^ 
2 1 0 affl^ y-fe-i^ ^ vfe-5> 
220 ttftttUJflMKS 
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7*VA&%M 9 8024 Vi/VbVM 
-Xb 4 148 

r^U^-^E 980 74 v^yhyjtl 

05 33 

mmm 

T^'j^^ffil 981 03 ^VbyiW 
624 fyA'-3 
(72)^M *A*TV f^~. AW 

T^U^^Il 98 133 7vyh>-#l 

(72)^BM S# v-. ;W\-;OW 

r^u^-^ll 981 22 v^yhyffl 

i-y/-s-2 0 9 

7*Vti&mm 9 801 9 7yyh^ 
1 7 



7*-/l^ >-r-f 287 T^-a- *t*7XA 
-tvS-yi/A y-X-f-Xh 2 3 3-h 2 
y7^ *fyfvy 7^-1- y-X 3 
1/7 b)l /-X 105 y.hU-h 93 9 
; s7b)V A-Xb >MV XbV-b 417 
b#>l J-XA-Xb 14 0 n-h 27 5 



(38) W 182004-362599 (P2004-362559A) 



2004362559000001.pdf 



